The function would return a zero-length berval in that case. There's a
difference between no values, and one value of zero length.

Sure, but for the programmer, there is definitely a difference between
p == NULL and *p == NULL. :-)

Of course. And again, that's a one-to-one mapping to the difference between no
values (p == NULL) and one value of zero-length. Since both conditions are
legal in the ASN.1 data, as a programmer you must handle both. (Even though
it's nonsensical in this context, and the server is clearly broken.)